Spring Oauth2配置授权endpoint

Question

我使用spring-security-oauth2:2.3.3和spring-boot-starter-security:2.0.2构建了带有REST WS的Spring web app。但我无法设置哪些endpoint受到保护。

@EnableResourceServer
@Configuration
public class ResourceServerConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                .antMatchers("/", "/customers", "/v2/**").permitAll()
                .antMatchers("/api/**").authenticated();
    }

    @Bean
    public AuthenticationManager authenticationManager(AuthenticationProvider authenticationProvider) {
        return new CustomAuthenticationManager(authenticationProvider);
    }

    @Bean
    public AuthenticationProvider authenticationProvider(UserRepository userRepository, PasswordEncoder passwordEncoder) {
        return new DBAuthenticationProvider(userRepository, passwordEncoder);
    }

}

@Configuration
@EnableAuthorizationServer
public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {

    @Autowired
    private AuthenticationManager authenticationManager;

    @Override
    public void configure(AuthorizationServerSecurityConfigurer security) {
        security.checkTokenAccess("isAuthenticated()");
    }

    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        clients
                .inMemory()
                .withClient("ClientId")
                .secret("secret")
                .authorizedGrantTypes("password")
                .scopes("read", "write");
    }

    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) {
        endpoints.authenticationManager(authenticationManager);
    }
}

{"error":"unauthorized","error_description":"Full authentication is required to access this resource"}

添加“--header”authorization：Basic{{base64 client id:password}}“也没有帮助。这怎么可能呢？

根据spring security permitAll进行编辑，仍然考虑在授权头中传递的令牌，如果令牌无效，则返回401，通过向ResourceServerConfig添加@order(1)来覆盖默认的oauth2来解决。但只有在添加“授权”标题时才会出现这种情况，而我的情况并非如此。那么这怎么可能呢？

Answer 1

将此添加到项目中。

@Configuration
public class ResourceServer extends ResourceServerConfigurerAdapter {
    @Override
    public void configure(HttpSecurity http) throws Exception {
        http.antMatcher("/user/**")
        .authorizeRequests().anyRequest().authenticated();
    }
}

如果要向/user/**发出任何请求，则需要将头中的访问令牌作为Authorization:Bearer{access_token}传递。所有其他endpoint都不会请求令牌。